Email security

How to fix: DKIM record

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your outgoing email. The matching public key is published in DNS so receivers can verify the message wasn't altered and really came from your domain.

Not sure whether your site has this problem? Check it in seconds.

Email Security checker Run a free audit

Why it matters

DKIM survives forwarding better than SPF and is one of the two signals DMARC relies on. Without it, mail from your domain is easier to spoof and more likely to be treated as suspicious.

How to check

DKIM keys live at <selector>._domainkey.yourdomain.com, and the selector is chosen by your email provider, so it can't be guessed with certainty. Nexora Shield only tries a handful of very common selectors; if none is found, that does NOT prove DKIM is missing. Check your provider's admin console for the exact record.

How to fix it

Record shape

Type: TXT   Name: selector1._domainkey   Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqh... (your provider's public key)

Where to find it

Google Workspace: Admin console → Apps → Google Workspace → Gmail → Authenticate email
Microsoft 365: Defender portal → Email & collaboration → Policies → DKIM
Other providers: look for "DKIM" or "domain authentication" in the sending settings

Common mistakes

Copying the key with stray spaces or line breaks; many DNS panels need it as one continuous string.
Publishing the record but never switching on signing in your email provider.

Frequently asked questions

Why does the scanner say it couldn't find DKIM when I have it?

Because selectors are provider-specific and we only test common ones. Treat that result as 'not confirmed', not 'missing'.

Related guides

Guidance is general. Test header and DNS changes on a staging copy first, and check your hosting provider's documentation for platform-specific steps.